Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
Source hashes
MD5 checksum: dd010be4950db17ebe05b213cd57f6c4
SHA1 checksum: c4069f4a8681ef7e4cfed734f4b8794646039fc5
/dev/sdb: current max LBA: 156,301,488
/dev/sdb: native max LBA: 156,301,488
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA not set
/dev/sdb: DCO not set
Device Start End #sectors File System Size
/dev/sdb1 63 6297479 6297417 NTFS 3Gb
/dev/sdb2 6297543 10490444 4192902 Ext2 2Gb
/dev/sdb3 10490508 14683409 4192902 Ext3 2Gb
/dev/sdb4 14683473 16787924 2104452 FAT16 1Gb
/deb/sdb5 18892503 20996954 2104452 Swap 1Gb
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Starting Sector: 10,490,508
Sector Count: 4,192,902
Source data size: 2047 MB
MD5 checksum: dd010be4950db17ebe05b213cd57f6c4
SHA1 checksum: c4069f4a8681ef7e4cfed734f4b8794646039fc5
Acquisition started: Tue Jul 27 01:56:23 2010
Acquisition finished: Tue Jul 27 01:57:43 2010
Verification started: Tue Jul 27 01:57:43 2010
Verification finished: Tue Jul 27 01:58:18 2010
MD5 checksum: dd010be4950db17ebe05b213cd57f6c4 : verified
SHA1 checksum: c4069f4a8681ef7e4cfed734f4b8794646039fc5 :
verified
AFR-01 PASSED AIC-01 PASSED
AFR-02 PASSED AIC-05 PASSED
AFR-03 PASSED ALOG-01 PASSED
AFR-04 PASSED ALOG-02 PASSED
AFR-05 PASSED ALOG-03 PASSED
AFR-07 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification
hashes.
163